An unknown threat actor has been sitting in GoDaddy’s systems for years, installing malware, stealing source code, and attacking the company’s customers, the web hosting giant confirmed in an SEC filing late last week.
Per the filing (opens in new tab) (via BleepingComputer (opens in new tab)), the attackers breached GoDaddy’s cPanel shared hosting environment and used that as a launch pad for further attacks. The company described the hackers as a “sophisticated threat actor group”.
The group was eventually spotted when customers started reporting, late in 2022, that the traffic coming to their websites was being redirected elsewhere.
Links to previous incidents
Now, GoDaddy believes that the data breaches that were reported in March 2020 and November 2021 were all linked.
“Based on our investigation,” it wrote in the filing, “we believe these incidents are part of a multi-year campaign by a sophisticated threat actor group that, among other things, installed malware on our systems and obtained pieces of code related to some services within GoDaddy,”
During the November 2021 incident, the user data of some 1.2 million of its customers were accessed by the attackers. This included both active and inactive users, with email addresses and customer numbers being exposed.
The company also said that the original WordPress admin password, created once a new install of WordPress has completed, was also exposed, giving attackers access to those installations.
GoDaddy also revealed that active customers had their sFTP credentials and the usernames and passwords for their WordPress databases, that are used to store all of their content, exposed in the breach.
However, in some cases, customer's SSL private keys were exposed and if abused, this key could allow an attacker to impersonate a customer's website or other services.
While GoDaddy has reset customer WordPress passwords and private keys, it is currently in the process of issuing them new SSL certificates.
In a statement (opens in new tab) published in February 2023, the web hosting giant claims to have employed an external cybersecurity forensics team, and brought in law enforcement agencies from all over the world to investigate the matter further.
It's also clear, now, that attacks on GoDaddy were part of a wider campaign on web hosting companies around the world.
“We have evidence, and law enforcement has confirmed, that this incident was carried out by a sophisticated and organized group targeting hosting services like GoDaddy,”
“According to information we have received, their apparent goal is to infect websites and servers with malware for phishing campaigns, malware distribution and other malicious activities.”
English
Arabic
Belarusian
Bengali
Bosnian
Bulgarian
Chinese (Simplified)
Croatian
Czech
Danish
Dutch
Estonian
Filipino
Finnish
French
Georgian
German
Greek
Gujarati
Hausa
Hebrew
Hindi
Hmong
Hungarian
Igbo
Indonesian
Italian
Japanese
Javanese
Kazakh
Korean
Kurdish (Kurmanji)
Kyrgyz
Lao
Latvian
Lithuanian
Macedonian
Malagasy
Norwegian
Persian
Polish
Portuguese
Punjabi
Romanian
Russian
Serbian
Slovak
Slovenian
Spanish
Swedish
Thai
Turkish
Ukrainian
Vietnamese
Yoruba